CheatDetector 0.5.2.1

CD - CheatDetector [BF3/BF4]

DescriptionStats Check
This plugin tries to detect cheaters by their BF3 Battlelog Stats. This is done in the following way:
When a new player has joined (by detecting new entries in the playerlist. not by the playerjoined event, to prevent spamming) his stats are fetched from his Battlelog page (3 requests).
This is done for 1 player every 30 seconds, to not trigger any restrictions on the Battlelog side using a fifo-queue (first in, first out. or fcfs (first come, first served))
Then every weapons stat (with more than 130 kills, or more headshots than kills with more than 20 kills) is checked against a collection of averages to decide if its normal, suspicious or impossible.

Strict Mode: A player is considered cheating if he has 4 suspicious stats or 1 IMPOSSIBLE stat.
Normal Mode: A player is considered cheating if he has 5 suspicious stats or 1 IMPOSSIBLE stat and 1 suspicious stat.

As you can see in the first line, the weapon "M60" on the player "Mong0lFPS" has a "k/h" (kills per hit ratio) of 100% (422 hits, 422 kills), which is 5,01 times higher than the average k/h on the M60. This is considered impossible.
Line 6 shows the summary of all checks for the player "Mong0lFPS". 99% cheating so this player would be kicked/banned or an admin notified.
Weapons with more headshots than kills (except shotguns, rockets and the like) and more than 20 kills will be treated as IMPOSSIBLE (=cheating).

Example:

weapon asval: player x has 300 kills
the average hs/k on the asval is 25,85% thats 77 headshots

suspicious would be having a hs/k of 69,79% which is 209 headshots. (270% above the average)
impossible would be having a hs/k of 82,72% which is 248 headshots. (320% above the average)

the table shows what is considered suspicious and impossible

check

suspicious (% above average)

impossible (% above average)

accuracy

320%

370%

hs/k

270%

320%

k/h

270%

320%

k/m

500%

800%

spm

~340%

~500%

Live Check
From version 0.4 CheatDetector features a Live Protection.
Every 5 minutes all players (except players in the whitelist) will be checked for their headshots per kills (hs/k) and kills per minute (kpm) during their time on your server.
A player is considered cheating if he has > 91% hs/k or > 8 kpm with at least 20 kills. This is basically (average over all weapons) the same limit CheatDetector uses for Stats Check.
Note that Live Check does not distinguish between weapons or vehicles. (This is not reported by the game server)

If 0. Enable Live Check is set to "Yes" these 2 players will be kicked (or banned, depending on your settings).
For the message displayed to the kicked player %suspiciousstat% will be replaced with "too many hs/k or k/min (CD - LiveCheck)" instead of a certain weapon.
This will protect your server from cheaters with clean (or resetted) stats. You can see the checks for non-cheaters on debug level >=3.

Stream players to 247FairPlay.comhttp://www.247FairPlay.com is a website providing stats, forum and ban appeal for my server and my bans.
Since version 0.4 you can stream the players on your server to a database at 247FairPlay.com. This DB will be used to check the players in addition to the CheatDetector plugin on your server. The plugin will not be blocked by this and errors (for example: you cant reach 247fairplay.com) wont show up in the log. its "fire and forget".
You can see the requests on debug level >=3.
These checks include extended stats check, linked accounts, history check to name just a few (note that some of these features are still in development)
Detected cheater will be banned through the metabans.com account @CheatDetector (http://metabans.com/CheatDetector)

How do you make use of these checks? Simple: install metabans plugin and follow @CheatDetector to enforce the bans on the detected cheaters. Depending on the usage (and several more restrictions), it might take some time to get checks done.

You will find further information about the new CheatDetector features in the CheatDetector thread at Procon forums, at 247FairPlay.com forum or here as it develops :-)

THANK YOU
THX & Credits go to the following people (and more i'm sure):
all Procon Devs for Procon and their API :-)
i-stats.net & symthic.com & bf3stats & cheatometer for their massive DBs of weapon and player values and known cheaters
Panther for showing how to use that API and other Plugin stuff
Phil & Phogue & MorpheusX for all their support and tips and letting me nag em :-)
EBastard & HexaCanon & PapaCharlie & ty_ger & dyn & IAF SDS & all the other for testing, reporting & various tips

Plugin (recommended) Settings
0. Ban Method and Whitelist and BattlelogCache
Servertype: BF3/BF4/Automatic. (Automatic)
TempBan/Ban by name: Not recommended. A Player can easily change their name and join again. (No)
TempBan/Ban by EA GUID: Recommended. This ID is linked to the player's EA account. Works best with Metabans (Yes)
TempBan/Ban by PB GUID: Recommended. This ID is linked to the player's cd key (No)
Whitelist: List of players (ingame-names without clantag) not to check
Sync ReservedSlots/ServerVIPs: Automatically syncronize the players in the ReservedSlot list with the Plugin Whitelist (Yes)
Use BattlelogCache if available: Use the Battlelog Cache to reduce traffic (Yes)
Stream Players to 247FairPlay.com: If enabled CheatDetector will contact http://www.247fairplay.com/cheatdetector.php every 30 minutes to add the players on your server to a database to do stats checks and various other checks. If a cheater is detected, he will be banned through the MetaBans Account @CheatDetector (http://metabans.com/CheatDetector). (Yes)
Enable Stats Check: Enable the stats check through battlelog. (Yes)
Enable Strict Mode: When enabled: 1 IMPOSSIBLE or 4 suspicious stats is considered cheating (=kick/ban). When set to NO: 1 IMPOSSIBLE and 1 suspicous or 5 suspicious stats is considered cheating. (NO)
Enable Live Check: Enable the ckecking of the players hs/k and kpm on your server. (Yes)

2. Kick
Enable Kick: No
Message to be displayed to the kicked player: %playername% will be replaced with the players name. %pbguid% will be replaced with the players PunkBuster GUID. %eaguid% will be replaced with the players EA GUID. %suspiciousstat% will be replaced with the most significant detected stat. (SUSPECTED CHEATING: %playername% %suspiciousstat%)

3. TBan
Enable Temp: If temp ban is enabled, no kick will happen (Yes)
Message to be displayed to the temp banned player: %playername% will be replaced with the players name. %pbguid% will be replaced with the players PunkBuster GUID. %eaguid% will be replaced with the players EA GUID. %suspiciousstat% will be replaced with the most significant detected stat. (SUSPECTED CHEATING: %playername% %suspiciousstat%)
Length of Temp Ban (min): Length of temp ban in minutes (15)

4. Ban
Enable ban: If permanent ban is enabled, no temp ban or kick will happen (No)
Message to be displayed to the banned player: %playername% will be replaced with the players name. %pbguid% will be replaced with the players PunkBuster GUID. %eaguid% will be replaced with the players EA GUID. %suspiciousstat% will be replaced with the most significant detected stat. (SUSPECTED CHEATING: %playername% %suspiciousstat%)

5. Notify
Enable ingame notification: Yell a message to an admin (or any other player) when a player is detected by this plugin (Yes)
Enable private/public notification: Enable the desired type(s) of notification
Ingame username: player to receive the ingame notification
Message to be displayed: Message to be displayed to the ingame playername (CheatDetector - SUSPECTED CHEATING: %playername% %suspiciousstat%)
Time to display (sec): Time to display the ingame notification in seconds (30)

6. Debug
Debug Level (0-5): Debug level adjusting how many debug messages you will see in the plugin console log (1)
0 - no messages at all (quiet)
1 - only detections/kicks/bans will be displayed
2 - will also show log entries for normal players and some queue timeout operation when neccessary
3 - will also show the queue size and number of players enqueued, adding and removing of players to the playerlist and queue, skipping of whitelisted players, queue timeout operations
4 - will also show checked and skipped weapons, a lot more internal operations, "expected" errors (dont worry ;-))
5 - just for development and testing

Automatic Update Check: Check for Plugin Updates every 3 hours. (Yes)
Log to file: Log plugin output to a file (CDLogFile.txt) in the Plugin/BF3 directory. Not recommended, this file may get very big and slow your procon down. Only use it to log errors and only use it local (No)
Filename/Path: Filename and path of the logfile relative to the Procon executable (Plugins/BF3/PBSSELogFile.txt)
Advanced: DO NOT PLAY WITH THESE VALUES UNLESS INSTRUCTED BY ME OR YOU WILL BREAK THE PLUGIN (NO)

DO NOT EDIT ANY OF THE BELOW SETTINGS - LAST WARNING - VERBOTEN
Lazy Queue: When enabled, the plugin will also check players that left the server while being enqueued (No)
Orange Flag Score per Min: Set the SPM needed to raise a suspicious flag (1200)
Red Flag Score per Min: Set the SPM needed to raise a IMPOSSIBLE flag (2000)
Min Kills: Minimum Kills needed for a weapon to be analyzed (200)
Min Kills (live): Minimum Kills needed for a player to be checked during Live Check (30)
Max hsklive: Headshots per Kill Percentage needed to raise a IMPOSSIBLE flag during Live Check (0.91)
Max kmlive: Kills per Minute needed to raise a IMPOSSIBLE flag during Live Check (8)
Name: List of Players to check when TEST (Option below) is set to Yes
Test: Check Players listed in NAME (Option Above) (No)
Retries: Retry stats fetching X times when failed (1)
Timeout Test: Let all requests to fetch stats fail. Just for testing (No)
Stream to Master: Settings for streaming to my mysql server. (No)

Version History (Changelog):0.5.2.1
-Fix: Added placeholders for new Final Stand DLC weapons.
-Fix: Other minor fixes.

0.4.3
-FIX: More headshots than kills will be treated as headshots equal to kills to reduce the chance of false detections.
-FIX: Increased minimum kills to 200 to reduce the chance of false detections.
-FIX: Live Check: Increased minimum kills to 30 to reduce the chance of false detections.

0.4.2
-NEW: Settings: Enable Strict Mode (When enabled: 1 IMPOSSIBLE or 4 suspicious stats is considered cheating (=kick/ban). When set to NO: 1 IMPOSSIBLE and 1 suspicous or 5 suspicious stats is considered cheating.)
-FIX: More headshots than kills are only considered IMPOSSIBLE (or suspicious) if they exceed the average by 320% (270%). See https://forum.myrcon.com/showthread....ll=1#post75230.

0.4.1
-FIX: Increased minimum kills needed for weapons with more headshots than kills back to 130.

0.4
-NEW: Live Check: CheatDetector will now monitor the players on your server for headshots per kills and kills per minute. Cheating is considered >91% HS/K or >8 KPM with more than 20 kills. A check is made every 5 minutes. Whitelist and messages apply here too. (0. Ban Method and Whitelist and BattlelogCache -> Enable Live Check)
-NEW: Stream Players to 247FairPlay.com: If enabled CheatDetector will contact http://www.247fairplay.com/cheatdetector.php every 30 minutes to add the players on your server to a database (the plugin will not be blocked by this and errors (for example: you cant reach 247fairplay.com) wont show up in the log. its "fire and forget"). This DB will be used to do stats checks and various other checks. If a cheater is detected, he will be banned through the MetaBans Account @CheatDetector (http://metabans.com/CheatDetector).
-FIX: Stats Check: Weapons with more headshots than kills (except shotguns, rockets and the like) and more than 20 kills will be treated as IMPOSSIBLE (=cheating).
-NEW: Settings: Enable Live Check.
-NEW: Settings: Enable Stats Check.
-NEW: Settings: Stream Players to 247FairPlay.com
-NEW: Settings: Exclude Non-ReservedSlots/ServerVIPs: will automatically remove players from the plugins whitelist that are not in your ReservedSlots List
-FIX: Several internal code improvements.

0.3
-NEW: You can now use Battlelog Cache to reduce traffic. (0. Ban Method and Whitelist and BattlelogCache -> Use BattlelogCache if available)
-FIX: The Output on certain debug levels have been adjusted to be not so spamming.
-FIX: 2 Typos in Weapon Names have been fixed (M1911 Tactical) which caused this weapon to not be analyzed for k/h and k/m.
-FIX: Under certain circumtances endless ingame notification could happen. This is now fixed.
-FIX: When a player is banned (TBan and Ban) a Kick will make sure the player is gone.
-FIX: Added placeholders %pbguid% and %eaguid% to the messages.
-FIX: Increased the max TBan time to 100 years (was 1 year), but you might as well use permanent there :-)
-FIX: Several internal code improvements.

0.2.1
-NEW: You can now setup the ingame notification (4. Notify) in detail.
-FIX: Tiny update to the scores to find the best reason (most suspicious/impossible stat) to be used in various messages.
-FIX: SPM is now only taken into account if the playtime is above 1 hour.
-FIX: small code updates.

0.2
-UPDATE: You can now download/update CheatDetector directly through your procon gui.

0.1.2
-FIX: The plugin will now automatically detect when the BF3 Battlelog Request Limit is reached. Then it will increase the queue timeout. The timeout will then be decreased step by step to normal.
-FIX: An error happened when there were multiple detections with the same score. This is now fixed
-FIX: not that important error messages are now displayed properly (Debug level 2, 3, 4)

Known IssuesCheat Detection
Since this plugin tries to detect cheaters using their BF3 Battlelog stats, it is limited to that data. If a cheater got his stats reset, there is no way for this plugin (as of now version 0.1.2) to detect the cheater.
On the other hand, this plugin might detect someone as a cheater who is not cheating.
Workaround (cheater not detected): None. Inform me about this issue. Maybe i will add other data sources for cheat detection in the future.
Workaround (normal player detected as cheater): Add this player to your whitelist and inform me about this false positive.

Whitelist
If you add a player to your ReservedSlots/ServerVIP List they might not show up in the whitelist setting immediately. However you can be sure they are added and processed. I think this is because Procon GUI does not reload the setting when its not changed in the GUI. Just reopen the Plugins Tab and they should be displayed. Or restart Procon on your PC (NOT the layer server, just the exe on your PC) and they will show up.
Workaround: Not really needed, however if someone knows a solution i would like to know it too :-)

Logfile
This file may get very big and slow your procon down. Only use it to log errors and only use it local. The directory must also exist and be writeable by your procon.

Great, another plugin hammering the already "overloaded" Battlelog with requests.
You will most likely have to change your stats fetching mechanisms in the nearer future due to request limits and problems coming with that.

Before posting: Have you read the MANUAL?Before posting: Have you used the SEARCH?

I will not provide support through PMs or TeamSpeak. Please post your questions in our forums.